# CVE-2022-39251: Matrix matrix-js-sdk user spoofing via protocol confusion

Source: https://junglewise.ai/threats/cve-2022-39251-matrix-matrix-js-sdk-user-spoofing-via-protocol-confusion  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-09-30. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2022-39251 · Severity: low · CVSS 3.1 · Published 2022-09-30

Matrix's JavaScript SDK for end-to-end encrypted messaging accepts improperly encrypted messages, allowing an attacker colluding with a malicious homeserver to forge messages appearing to come from other users. An attacker could inject fake key backup secrets or other sensitive data, potentially compromising message authenticity and user verification systems without visible warnings to the recipient.

Technologies: [matrix-js-sdk (npm)](https://junglewise.ai/threats/technologies/matrix-js-sdk). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2022-39251 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2022-39251 being exploited in the wild.

**How severe is CVE-2022-39251?** Low severity, with a CVSS score of 3.1, published 30 September 2022.

**Which products and versions are affected?** matrix-js-sdk (npm) SEMVER:introduced=0,fixed=19.7.0.

**Is there a fix for CVE-2022-39251?** Yes. matrix-js-sdk (npm): upgrade to 19.7.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2022-39251 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2022-39251?** Check whether you run matrix-js-sdk (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- matrix-js-sdk (npm): upgrade to 19.7.0 or later

  ```sh
  npm install matrix-js-sdk@19.7.0
  ```


## Technical details

The vulnerability stems from a protocol confusion flaw in the Olm/Megolm encryption handling: the SDK incorrectly accepts to-device messages encrypted with Megolm instead of requiring the stricter Olm encryption. This allows an attacker coordinating with a malicious homeserver to construct forged messages with a legitimate origin appearance. The attack vector is network-based and requires no user interaction or special authentication. An attacker can spoof message sources, inject backdoored key backup secrets during self-verification flows, or manipulate device keys. The fix restricts to-device messages to Olm encryption only, adds validation for key backup signatures from trusted devices, and discards cleartext cryptographic material messages. Version 19.7.0 and later contain the patches.

## Affected products

- Matrix matrix-js-sdk <19.7.0

## Identifiers

- CVE-2022-39251
- GHSA-r48r-j8fx-mq2c

## Timeline

- 2022-09-28: disclosed: Security advisory published
- 2022-09-30: patched: Version 19.7.0 released with fixes

## References

- [https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-r48r-j8fx-mq2c](https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-r48r-j8fx-mq2c)

## Related threats

- [matrix-js-sdk insufficient validation in room upgrade handling](https://junglewise.ai/threats/cve-2025-59160-matrix-js-sdk-insufficient-validation-in-room-upgrade-handling)
- [matrix-js-sdk MXC URI path traversal](https://junglewise.ai/threats/cve-2024-50336-matrix-js-sdk-mxc-uri-path-traversal)
- [Matrix JavaScript SDK key history sharing vulnerability](https://junglewise.ai/threats/cve-2024-47080-matrix-javascript-sdk-key-history-sharing-vulnerability)
- [matrix-js-sdk infinite recursion in room upgrade history](https://junglewise.ai/threats/cve-2024-42369-matrix-js-sdk-infinite-recursion-in-room-upgrade-history)
- [matrix-js-sdk unauthorized eavesdropping in group calls](https://junglewise.ai/threats/cve-2023-29529-matrix-js-sdk-unauthorized-eavesdropping-in-group-calls)